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FIG. 2 



200 

/ 

Intrusion Detection System 

250 

^ 

Logic 



300 

</ 

Base Intrusion Sets 



400 

Action Sets 



500 



Analysis Engine 



RSW920010138US1 
Dynamic Intrusion Detection for Computer Systems 
Brock, A. et al 
3/6 



© 

P> 



f 



o 
p> 

VJ 



OS r- 



Ul 
♦» 

o 
p> 

VJ 



CD 
CO 



CO 
CD 



ts ^ «— 
c <d * 

CO h- 



O 

p> 



CD 


5 




CD 


CO CD 


C > 


c 


O) LU 




0) 


Co 



to 






s> 


o 


P> 




V 


CO 0) T7 




c > * 




CD LU 




CO 



o 

p> 



M 
O 

P> 

VJ 



ft 
o 

p> 

VI 







JZ 






CM 






1 





Ul 
<M 
O 
P> 

VJ 



CD 
CO 
CO 
CO 



c 
g 

< 











o 








CM 


CO 


CO 








CD 






CO 


(- 





o 
© 

PJ 





CM 


3 c 


&— 

0 
-*-* 


CO CD 


C > 


C 


O) LLI 




co 


Co 



9 

© 
P> 



0 
3 

CO 0 ™ 
C > * 

g> LU 
CO 



a 

o 

p> 

M 



"35 cm 
CO * 



P> 
© 
pj 



s 

p) 



.2> CO 
CD * 



8 
p> 

M 



■B « 

< 



Q 

§ 

p) 





old 






sh 


CO 


C 












CO 







o 

p> 
o 
p> 



2 

3 c 

CO 0 

c > 
O) LU 

(75 



CO 
0 

sz 

3 
O 

O 



OB 

I 



2> 

"S <D CO 
c > * 
g> 111 

CO 



Si 

© 
P) 



V 



o5 co 
CO * 



s 

p> 



I 

p) 

VI 



0 5 



Ul 

s 

p> 



0 



3 I 
15 to S 

CO |_ 



O 

S 

p> 



2 

B c 

CO <D 
C > 
D) LU 

CO 



3 

0 

-4— • 

c 

3 
O 

O 



i 

p> 

VJ 



g> LU 
CO 



P) 



RSW920010138US1 
Dynamic Intrusion Detection for Computer Systems 
Brock, A. et al. 
4/6 



d 



/ 



o 
o 



o 

vf 



c -22 

CD 
> 



o 

< 



O 

V[ 



C O 
O -C 

O 0) * 



O" 



£1^ 

< o 



V] 



c 

3 



0J 17 
C/> 



CM 
© 



V 



8 



£ H g 
< ^ 



o 

I 



c o 

O d) * 

< j= 

h- 



8 



C 0) 
.2 C CM 

S3* 

< o 



2 



V 



c 
o 

o 

< 



"35 csj 
to * 



S 

VI 



8 

© 

VI 



| 3 co 

< ^ 



O 

8 

VI 



o 

is 
< 



o 

(D ^ 



to 

I 



N g 4 



a) 

C CO 

< o 



3 

© 

V 



.2 ai co 
c5 co * 
< 



s 



V 



1 



lis 

< ^ 



O 
3 

VI 









O 


ctio 




< 


Thr 



I 



V 



c 
o 

< 



0) 



2 

VI 



I * a 
t3 co * 

< 



» ' r RSW920010138US1 

Dynamic intrusion Detection for Computer Systems 
Brock, A etal 
5/6 



S 



8 



g 

'to 

> 
o 



6 

h-H 



Si 

V 



IS 

^ o 



o 
If) 

V 



0) 



o 



M 
O 
V) 



o 
8 

Vj 



C 

o 

ic 

cl 



s 



-J— « .is 

1 =5 cm 
^ O 



S 

o 

VI 



CD 

-S CM 



§ 



u 

i 

if) 



c 
o 

■> °° 

o 

5— 





c 


>> 


o 




T3 CO 




c 


3 


Co 



g 

V] 



-= CO 

a: ^ 



RSW920010138US1 
Dynamic Intrusion Detection for Computer Systems 
Brock, A. et al 
6/6 



FIG. 6 
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